Changeset c876f29 for lib

Timestamp:

02/05/19 09:50:43 (2 years ago)

Author:

Jacob Van Walraven <jcv9@…>

Branches:

develop

Children:

5e5b6ca

Parents:

db919d5 (diff), 1c3f8d2 (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Resolve merge conflict attempt 2

Location:

lib

Files:

• format_dag25.c (modified) (3 diffs)
• format_dpdk.c (modified) (4 diffs)
• format_erf.c (modified) (11 diffs)
• format_etsilive.c (modified) (1 diff)
• format_linux_common.c (modified) (3 diffs)
• format_linux_int.c (modified) (3 diffs)
• format_linux_ring.c (modified) (4 diffs)
• format_ndag.c (modified) (1 diff)
• format_pcap.c (modified) (3 diffs)
• format_pcapfile.c (modified) (9 diffs)
• format_pcapng.c (modified) (18 diffs)
• libtrace.h.in (modified) (1 diff)
• linktypes.c (modified) (2 diffs)
• protocols.h (modified) (2 diffs)
• protocols_l2.c (modified) (10 diffs)
• protocols_pktmeta.c (modified) (2 diffs)
• trace.c (modified) (5 diffs)
• trace_parallel.c (modified) (4 diffs)

lib/format_dag25.c

@@ -174 +174 @@
  * many times or close a device that we're still using */
 struct dag_dev_t *open_dags = NULL;
+
+static bool dag_can_write(libtrace_packet_t *packet) {
+        /* Get the linktype */
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        if (ltype == TRACE_TYPE_CONTENT_INVALID) {
+                return false;
+        }
+
+        /* TODO erf meta should definitely be writable, pcapng meta
+         * could probably be converted into erf meta */
+        if (ltype == TRACE_TYPE_ERF_META
+                        || ltype == TRACE_TYPE_NONDATA
+                        || ltype == TRACE_TYPE_PCAPNG_META) {
+                return false;
+        }
+
+        return true;
+}
 
 /* Returns the amount of padding between the ERF header and the start of the
@@ -1186 +1205 @@
 static int dag_write_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet)
 {
+        /* Check dag can write this type of packet */
+        if (!dag_can_write(packet)) {
+                return 0;
+        }
+
         /* This is heavily borrowed from erf_write_packet(). Yes, CnP
          * coding sucks, sorry about that.
@@ -1200 +1224 @@
                 return -1;
         }
-
-        if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)
-                return 0;
 
         pad = dag_get_padding(packet);

lib/format_dpdk.c

@@ -145 +145 @@
 };
 
+static bool dpdk_can_write(libtrace_packet_t *packet) {
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        if (ltype == TRACE_TYPE_CONTENT_INVALID) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_NONDATA || ltype == TRACE_TYPE_ERF_META ||
+                        ltype == TRACE_TYPE_PCAPNG_META) {
+                return false;
+        }
+        return true;
+}
+
 /**
  * We want to blacklist all devices except those on the whitelist
@@ -255 +268 @@
         if((file = fopen(path, "r")) != NULL) {
                 int numa_node = -1;
-                fscanf(file, "%d", &numa_node);
+                if (fscanf(file, "%d", &numa_node) != 1) {
+                        numa_node = -1;
+                }
                 fclose(file);
                 return numa_node;
@@ -875 +890 @@
         if (port != format_data->port) {
                 fprintf(stderr, "Port does not match port in format data in dpdk_lsc_callback()\n");
-                return -1;
+                #if RTE_VERSION >= RTE_VERSION_NUM(17, 8, 0, 1)
+                return -1;
+                #else
+                return;
+                #endif
         }
 
@@ -1557 +1576 @@
 static int dpdk_write_packet(libtrace_out_t *trace,
                              libtrace_packet_t *packet){
+
+        /* Check dpdk can write this type of packet */
+        if (!dpdk_can_write(packet)) {
+                return 0;
+        }
+
         struct rte_mbuf* m_buff[1];
 

lib/format_erf.c

@@ -119 +119 @@
 } erf_index_t;
 
+static bool erf_can_write(libtrace_packet_t *packet) {
+        /* Get the linktype */
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        if (ltype == TRACE_TYPE_CONTENT_INVALID) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_PCAPNG_META
+                || ltype == TRACE_TYPE_NONDATA) {
+
+                return false;
+        }
+
+        return true;
+}
+
 /* Ethernet packets have a 2 byte padding before the packet
  * so that the IP header is aligned on a 32 bit boundary.
@@ -670 +686 @@
                 libtrace_packet_t *packet) 
 {
+
+        /* Check erf can write this type of packet */
+        if (!erf_can_write(packet)) {
+                return 0;
+        }
+
         int numbytes = 0;
         dag_record_t *dag_hdr = (dag_record_t *)packet->header;
@@ -679 +701 @@
                 return -1;
         }
-
-        if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)
-                return 0;
 
         if (!packet->header) {
@@ -770 +789 @@
         dag_record_t *erfptr = 0;
         erfptr = (dag_record_t *)packet->header;
-        uint8_t type = (erfptr->type & 0x7f);
+        uint8_t type;
+
+        if (packet->header == NULL) {
+                return ~0;
+        }
+
+        type = (erfptr->type & 0x7f);
         if (type != TYPE_LEGACY) {
                 /* The top-most bit is now used to indicate the presence of
@@ -777 +802 @@
         }
         else {
+                if (trace_get_capture_length(packet) < 5 ||
+                                packet->payload == NULL) {
+                        return ~0;
+                }
+
                 /* Sigh, lets start wildly guessing */
                 if (((char*)packet->payload)[4]==0x45)
@@ -787 +817 @@
         dag_record_t *erfptr = 0;
         erfptr = (dag_record_t *)packet->header;
-        return erfptr->flags.iface;
+        if (packet->header) {
+                return erfptr->flags.iface;
+        }
+        return TRACE_DIR_UNKNOWN;
 }
 
@@ -793 +826 @@
         dag_record_t *erfptr = 0;
         erfptr = (dag_record_t *)packet->header;
+
+        if (packet->header == NULL) {
+                return TRACE_DIR_UNKNOWN;
+        }
         erfptr->flags.iface = direction;
         return erfptr->flags.iface;
@@ -800 +837 @@
         dag_record_t *erfptr = 0;
         erfptr = (dag_record_t *)packet->header;
+
+        if (erfptr == NULL) {
+                return 0;
+        }
         return bswap_le_to_host64(erfptr->ts);
 }
@@ -809 +850 @@
         uint16_t wlen, rlen;
 
-        if (packet->payload == NULL)
+        if (packet->payload == NULL || packet->header == NULL)
                 return 0;
 
@@ -828 +869 @@
         erfptr = (dag_record_t *)packet->header;
 
+        if (packet->header == NULL) {
+                return 0;
+        }
+
         if ((erfptr->type & 0x7f) == TYPE_META)
                 return 0;
@@ -843 +888 @@
         }
         erfptr = (dag_record_t *)packet->header;
+
+        if (packet->header == NULL) {
+                return ~0U;
+        }
 
         if(size > trace_get_capture_length(packet) || (erfptr->type & 0x7f) == TYPE_META) {

lib/format_etsilive.c

@@ -362 +362 @@
                                 sizeof(etsisocket_t) * (et->sourcealloc + 10));
 
+                        for (i = et->sourcealloc; i < et->sourcealloc + 10;
+                                        i++) {
+                                et->sources[i].sock = -1;
+                                et->sources[i].srcaddr = NULL;
+                        }
                         esock = &(et->sources[et->sourcealloc]);
                         et->sourcealloc += 10;

lib/format_linux_common.c

@@ -70 +70 @@
         pcap_t *pcap;
 
-        /* Take a copy of the filter object as it was passed in */
-        f = (libtrace_filter_t *) malloc(sizeof(libtrace_filter_t));
-        memcpy(f, filter, sizeof(libtrace_filter_t));
+        /* Take a copy of the filter structure to prevent against
+         * deletion causing the filter to no longer work */
+        f = (libtrace_filter_t *) malloc(sizeof(libtrace_filter_t));
+        memset(f, 0, sizeof(libtrace_filter_t));
+        memcpy(f, filter, sizeof(libtrace_filter_t));
+        f->filterstring = strdup(filter->filterstring);
 
         /* If we are passed a filter with "flag" set to zero, then we must
@@ -120 +123 @@
 
         if (FORMAT_DATA->filter != NULL)
-                free(FORMAT_DATA->filter);
+                trace_destroy_filter(FORMAT_DATA->filter);
 
         FORMAT_DATA->filter = f;
@@ -498 +501 @@
         if (libtrace->format_data) {
                 if (FORMAT_DATA->filter != NULL)
-                        free(FORMAT_DATA->filter);
+                        trace_destroy_filter(FORMAT_DATA->filter);
 
                 if (FORMAT_DATA->per_stream)

lib/format_linux_int.c

@@ -53 +53 @@
 #include "format_linux_common.h"
 
+#define SLL_HEADER_LENGTH 6
 
 #ifdef HAVE_NETPACKET_PACKET_H
 
+static bool linuxnative_can_write(libtrace_packet_t *packet) {
+        /* Get the linktype */
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        if (ltype == TRACE_TYPE_NONDATA) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_CONTENT_INVALID) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_PCAPNG_META) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_ERF_META) {
+                return false;
+        }
+
+        return true;
+}
 
 static int linuxnative_start_input(libtrace_t *libtrace)
@@ -336 +356 @@
                 libtrace_packet_t *packet) 
 {
+        /* Check linuxnative can write this type of packet */
+        if (!linuxnative_can_write(packet)) {
+                return 0;
+        }
+
         struct sockaddr_ll hdr;
         int ret = 0;
-
-        if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)
-                return 0;
 
         hdr.sll_family = AF_PACKET;
@@ -347 +369 @@
         hdr.sll_hatype = 0;
         hdr.sll_pkttype = 0;
-        hdr.sll_halen = htons(6); /* FIXME */
-        memcpy(hdr.sll_addr,packet->payload,(size_t)ntohs(hdr.sll_halen));
+        hdr.sll_halen = htons(SLL_HEADER_LENGTH); /* FIXME */
+        memcpy(hdr.sll_addr,packet->payload,(size_t)SLL_HEADER_LENGTH);
 
         /* This is pretty easy, just send the payload using sendto() (after

lib/format_linux_ring.c

@@ -71 +71 @@
 static int pagesize = 0;
 
+static bool linuxring_can_write(libtrace_packet_t *packet) {
+        /* Get the linktype */
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        if (ltype == TRACE_TYPE_CONTENT_INVALID) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_NONDATA) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_PCAPNG_META) {
+                return false;
+        }
+        if (ltype == TRACE_TYPE_ERF_META) {
+                return false;
+        }
+
+        return true;
+}
 
 /*
@@ -308 +327 @@
                 }
 
-                if (FORMAT_DATA->filter != NULL)
-                        free(FORMAT_DATA->filter);
+                if (FORMAT_DATA->filter != NULL)
+                        trace_destroy_filter(FORMAT_DATA->filter);
 
                 if (FORMAT_DATA->per_stream)
@@ -709 +728 @@
                                   libtrace_packet_t *packet)
 {
+        /* Check linuxring can write this type of packet */
+        if (!linuxring_can_write(packet)) {
+                return 0;
+        }
+
         struct tpacket2_hdr *header;
         struct pollfd pollset;
@@ -715 +739 @@
         unsigned max_size;
         void * off;
-
-        if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)
-                return 0;
 
         max_size = FORMAT_DATA_OUT->req.tp_frame_size -

lib/format_ndag.c

@@ -335 +335 @@
                 default:
                         trace_set_err(libtrace, TRACE_ERR_OPTION_UNAVAIL,
-                                        "Unsupported option");
+                                        "Unsupported option %d",
+                                        option);
                         return -1;
         }

lib/format_pcap.c

@@ -97 +97 @@
         } output;
 };
+
+static bool pcap_can_write(libtrace_packet_t *packet) {
+        /* Get the linktype */
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        if (ltype == TRACE_TYPE_PCAPNG_META
+                || ltype == TRACE_TYPE_CONTENT_INVALID
+                || ltype == TRACE_TYPE_UNKNOWN
+                || ltype == TRACE_TYPE_ERF_META
+                || ltype == TRACE_TYPE_NONDATA) {
+
+                return false;
+        }
+
+        return true;
+}
 
 static int pcap_init_input(libtrace_t *libtrace) {
@@ -521 +537 @@
 {
 
+        /* Check pcap can write this type of packet */
+        if (!pcap_can_write(packet)) {
+                return 0;
+        }
+
         if (!libtrace) {
                 fprintf(stderr, "NULL trace passed into pcap_write_packet()\n");
@@ -536 +557 @@
 
         link = trace_get_packet_buffer(packet,&linktype,&remaining);
-
-        /* Silently discard RT metadata packets and packets with an
-         * unknown linktype. */
-        if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_UNKNOWN || linktype == TRACE_TYPE_ERF_META || linktype == TRACE_TYPE_CONTENT_INVALID) {
-                return 0;
-        }
 
         /* We may have to convert this packet into a suitable PCAP packet */

lib/format_pcapfile.c

@@ -68 +68 @@
 #define MAGIC2_REV  0x4d3cb2a1
 
+static bool pcapfile_can_write(libtrace_packet_t *packet) {
+        /* Get the linktype */
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        if (ltype == TRACE_TYPE_PCAPNG_META
+                || ltype == TRACE_TYPE_CONTENT_INVALID
+                || ltype == TRACE_TYPE_UNKNOWN
+                || ltype == TRACE_TYPE_ERF_META
+                || ltype == TRACE_TYPE_NONDATA) {
+
+                return false;
+        }
+
+        return true;
+}
+
 static inline int header_is_backwards_magic(pcapfile_header_t *header) {
         return (header->magic_number == MAGIC1_REV || header->magic_number == MAGIC2_REV);
@@ -175 +191 @@
         if (!DATA(libtrace))
                 return num;
-        
+
         /* We can use the PCAP magic number to determine the byte order */
         if (header_is_backwards_magic(&(DATA(libtrace)->header)))
@@ -371 +387 @@
                         packet->buffer,
                         sizeof(libtrace_pcapfile_pkt_hdr_t));
+
         if (err<0) {
                 trace_set_err(libtrace,TRACE_ERR_WANDIO_FAILED,"reading packet");
@@ -387 +404 @@
         bytes_to_read = swapl(libtrace,((libtrace_pcapfile_pkt_hdr_t*)packet->buffer)->caplen);
 
-        if (bytes_to_read >= LIBTRACE_PACKET_BUFSIZE) {
+        if (bytes_to_read >= (LIBTRACE_PACKET_BUFSIZE -
+                        sizeof(libtrace_pcapfile_pkt_hdr_t))) {
                 trace_set_err(libtrace, TRACE_ERR_BAD_PACKET, "Invalid caplen in pcap header (%u) - trace may be corrupt", (uint32_t)bytes_to_read);
                 return -1;
@@ -432 +450 @@
                 libtrace_packet_t *packet)
 {
+
+        /* Check pcapfile can write this type of packet */
+        if (!pcapfile_can_write(packet)) {
+                return 0;
+        }
+
         struct libtrace_pcapfile_pkt_hdr_t hdr;
         struct timeval tv = trace_get_timeval(packet);
@@ -441 +465 @@
 
         ptr = trace_get_packet_buffer(packet,&linktype,&remaining);
-        
-        /* Silently discard RT metadata packets and packets with an
-         * unknown linktype. */
-        if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_UNKNOWN || linktype == TRACE_TYPE_ERF_META || linktype == TRACE_TYPE_CONTENT_INVALID) {
-                return 0;
-        }
 
         /* If this packet cannot be converted to a pcap linktype then
@@ -572 +590 @@
         struct timeval ts;
 
+        memset(&ts, 0, sizeof(struct timeval));
+
         if (!packet) {
                 fprintf(stderr, "NULL packet passed to pcapfile_get_timeval()\n");
@@ -601 +621 @@
         struct timespec ts;
 
+        memset(&ts, 0, sizeof(struct timespec));
         if (!packet) {
                 fprintf(stderr, "NULL packet passed to pcapfile_get_timespec()");
@@ -655 +676 @@
                         "pcapfile_get_wire_length()");
                 return -1;
+        }
+
+        if (packet->payload == NULL) {
+                return 0;
         }
 

lib/format_pcapng.c

@@ -48 +48 @@
 #define PCAPNG_CUSTOM_TYPE 0x00000BAD
 #define PCAPNG_CUSTOM_NONCOPY_TYPE 0x40000BAD
+#define PCAPNG_DECRYPTION_SECRETS_TYPE 0x0000000A
+
+#define PCAPNG_NRB_RECORD_END 0x0000
+#define PCAPNG_NRB_RECORD_IP4 0x0001
+#define PCAPNG_NRB_RECORD_IP6 0x0002
+
+#define PCAPNG_CUSTOM_OPTION_UTF8 0xBAC
+#define PCAPNG_CUSTOM_OPTION_BIN 0xBAD
+#define PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY 0x4BAC
+#define PCAPNG_CUSTOM_OPTION_BIN_NONCOPY 0x4BAD
+
+#define PCAPNG_OPTION_END 0x0000
 
 #define PACKET_IS_ENHANCED (pcapng_get_record_type(packet) == PCAPNG_ENHANCED_PACKET_TYPE)
@@ -54 +66 @@
 
 #define PACKET_IS_OLD (pcapng_get_record_type(packet) == PCAPNG_OLD_PACKET_TYPE)
-
 
 #define PCAPNG_IFOPT_TSRESOL 9
@@ -133 +144 @@
 typedef struct pcapng_interface_t pcapng_interface_t;
 
+struct pcapng_timestamp {
+        uint32_t timehigh;
+        uint32_t timelow;
+};
+
 struct pcapng_interface_t {
 
@@ -160 +176 @@
         uint16_t allocatedinterfaces;
         uint16_t nextintid;
+
+};
+
+struct pcapng_format_data_out_t {
+        iow_t *file;
+        int compress_level;
+        int compress_type;
+        int flag;
+
+        /* Section data */
+        uint16_t sechdr_count;
+        bool byteswapped;
+
+        /* Interface data */
+        uint16_t nextintid;
+        libtrace_linktype_t lastdlt;
 };
 
@@ -167 +199 @@
 };
 
+struct pcapng_custom_optheader {
+        uint16_t optcode;
+        uint16_t optlen;
+        uint32_t pen;
+};
+struct pcapng_nrb_record {
+        uint16_t recordtype;
+        uint16_t recordlen;
+};
 struct pcapng_peeker {
         uint32_t blocktype;
@@ -174 +215 @@
 typedef struct pcapng_peeker pcapng_hdr_t;
 
-
 #define DATA(x) ((struct pcapng_format_data_t *)((x)->format_data))
+#define DATAOUT(x) ((struct pcapng_format_data_out_t*)((x)->format_data))
+
+static char *pcapng_parse_next_option(libtrace_t *libtrace, char **pktbuf,
+                uint16_t *code, uint16_t *length, pcapng_hdr_t *blockhdr);
+
+static bool pcapng_can_write(libtrace_packet_t *packet) {
+        /* Get the linktype */
+        libtrace_linktype_t ltype = trace_get_link_type(packet);
+
+        /* TODO convert erf meta to pcapng meta? */
+        if (ltype == TRACE_TYPE_CONTENT_INVALID
+                || ltype == TRACE_TYPE_UNKNOWN
+                || ltype == TRACE_TYPE_ERF_META
+                || ltype == TRACE_TYPE_NONDATA) {
+
+                return false;
+        }
+
+        return true;
+}
 
 static pcapng_interface_t *lookup_interface(libtrace_t *libtrace,
                 uint32_t intid) {
 
-
-        if (intid >= DATA(libtrace)->nextintid) {
-                return NULL;
-        }
-
-        return DATA(libtrace)->interfaces[intid];
-
+        if (intid >= DATA(libtrace)->nextintid) {
+                return NULL;
+        }
+
+        return DATA(libtrace)->interfaces[intid];
 }
 
 static inline uint32_t pcapng_get_record_type(const libtrace_packet_t *packet) {
-
         uint32_t *btype = (uint32_t *)packet->header;
 
-        if (DATA(packet->trace)->byteswapped)
-                return byteswap32(*btype);
+        /* only check for byteswapped if input format is pcapng */
+        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
+                if (DATA(packet->trace)->byteswapped)
+                        return byteswap32(*btype);
+        }
+
         return *btype;
+}
+
+static inline uint32_t pcapng_swap32(libtrace_out_t *libtrace, uint32_t value) {
+        if (DATAOUT(libtrace)->byteswapped) {
+                return byteswap32(value);
+        } else {
+                return value;
+        }
+}
+static inline uint32_t pcapng_swap16(libtrace_out_t *libtrace, uint32_t value) {
+        if (DATAOUT(libtrace)->byteswapped) {
+                return byteswap16(value);
+        } else {
+                return value;
+        }
+}
+static inline uint32_t pcapng_get_blocklen(const libtrace_packet_t *packet) {
+        struct pcapng_peeker *hdr = (struct pcapng_peeker *)packet->buffer;
+
+        /* only check for byteswapped if input format is pcapng */
+        if (packet->trace->format->type == TRACE_FORMAT_PCAPNG) {
+                if (DATA(packet->trace)->byteswapped)
+                        return byteswap32(hdr->blocklen);
+        }
+
+        return hdr->blocklen;
+
+}
+
+#if 0
+static inline uint16_t pcapng_get_customdata_len(libtrace_packet_t *packet, char *ptr) {
+        struct pcapng_custom_optheader *hdr = (struct pcapng_custom_optheader *)ptr;
+
+        if (DATA(packet->trace)->byteswapped) {
+                return byteswap16(hdr->optlen);
+        } else {
+                return hdr->optlen;
+        }
+}
+static inline uint16_t pcapng_get_customdata_optcode(libtrace_packet_t *packet, char *ptr) {
+        struct pcapng_custom_optheader *hdr = (struct pcapng_custom_optheader *)ptr;
+
+        if (DATA(packet->trace)->byteswapped) {
+                return byteswap16(hdr->optcode);
+        } else {
+                return hdr->optcode;
+        }
+}
+#endif
+
+static inline uint16_t pcapng_get_nrb_record_type(libtrace_packet_t *packet, char *ptr) {
+        struct pcapng_nrb_record *hdr = (struct pcapng_nrb_record *)ptr;
+        if (DATA(packet->trace)->byteswapped) {
+                return byteswap16(hdr->recordtype);
+        } else {
+                return hdr->recordtype;
+        }
+}
+static inline uint16_t pcapng_get_nrb_record_len(libtrace_packet_t *packet, char *ptr) {
+        struct pcapng_nrb_record *hdr = (struct pcapng_nrb_record *)ptr;
+        if (DATA(packet->trace)->byteswapped) {
+                return byteswap16(hdr->recordlen);
+        } else {
+                return hdr->recordlen;
+        }
+}
+static uint32_t pcapng_output_options(libtrace_out_t *libtrace, libtrace_packet_t *packet,
+        char *ptr) {
+
+        struct pcapng_optheader opthdr;
+        uint16_t optcode, optlen;
+        char *optval = NULL;
+        char *bodyptr = NULL;
+        int padding;
+        void *padding_data;
+        uint32_t len = 0;
+
+        bodyptr = ptr;
+
+        while ((optval = pcapng_parse_next_option(packet->trace, &bodyptr,
+                        &optcode, &optlen, (pcapng_hdr_t *) packet->buffer))) {
+
+                /* pcapng_parse_next_option byteswaps the opcode and len for us */
+                opthdr.optcode = optcode;
+                opthdr.optlen = optlen;
+
+                /* output the header */
+                wandio_wwrite(DATAOUT(libtrace)->file, &opthdr, sizeof(opthdr));
+
+                /* If this is a custom option */
+                if (optcode == PCAPNG_CUSTOM_OPTION_UTF8 ||
+                        optcode == PCAPNG_CUSTOM_OPTION_BIN ||
+                        optcode == PCAPNG_CUSTOM_OPTION_UTF8_NONCOPY ||
+                        optcode == PCAPNG_CUSTOM_OPTION_BIN_NONCOPY) {
+                        /* flip the pen and output the option value */
+                        //uint32_t pen = byteswap32((uint32_t)*optval);
+                        wandio_wwrite(DATAOUT(libtrace)->file, optval, sizeof(uint32_t));
+
+                        /* the len for custom options include pen */
+                        optval += sizeof(uint32_t);
+                        optlen -= sizeof(uint32_t);
+                }
+
+                /* output the rest of the data */
+                wandio_wwrite(DATAOUT(libtrace)->file, &optval, optlen);
+
+                /* calculate any required padding */
+                padding = optlen % 4;
+                if (padding) { padding = 4 - padding; }
+                padding_data = calloc(1, padding);
+                /* output the padding */
+                wandio_wwrite(DATAOUT(libtrace)->file, padding_data, padding);
+                free(padding_data);
+
+                len += sizeof(opthdr) + optlen;
+        }
+
+        return len;
+}
+static uint32_t pcapng_output_interface_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+        pcapng_int_t *cur = (pcapng_int_t *)packet->header;
+        pcapng_int_t hdr;
+        char *bodyptr = NULL;
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
+                (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
+                uint32_t len = pcapng_get_blocklen(packet);
+                wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len);
+                return len;
+        }
+
+        /* Byteswap the headers */
+        hdr.blocktype = byteswap32(cur->blocktype);
+        hdr.blocklen = byteswap32(cur->blocklen);
+        hdr.linktype = byteswap16(cur->linktype);
+        hdr.reserved = byteswap16(cur->reserved);
+        hdr.snaplen = byteswap32(cur->snaplen);
+
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
+        /* output any options */
+        bodyptr = (char *)packet->buffer + sizeof(hdr);
+        pcapng_output_options(libtrace, packet, bodyptr);
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen));
+
+        return hdr.blocklen;
+}
+static uint32_t pcapng_output_simple_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+        pcapng_spkt_t *cur = (pcapng_spkt_t *)packet->header;
+        pcapng_spkt_t hdr;
+        uint32_t len;
+        char *bodyptr = NULL;
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
+                (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
+                len = pcapng_get_blocklen(packet);
+                wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len);
+                return len;
+        }
+
+        hdr.blocktype = byteswap32(cur->blocktype);
+        hdr.blocklen = byteswap32(cur->blocklen);
+        hdr.wlen = byteswap32(cur->wlen);
+
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
+
+        /* output the packet payload */
+        bodyptr = (char *)packet->buffer + sizeof(hdr);
+        len = pcapng_get_blocklen(packet) - sizeof(hdr) - sizeof(hdr.blocklen);
+        wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, len);
+
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen));
+
+        return hdr.blocklen;
+}
+static uint32_t pcapng_output_old_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+        pcapng_opkt_t *cur = (pcapng_opkt_t *)packet->header;
+        pcapng_opkt_t hdr;
+        uint32_t len;
+        char *bodyptr = NULL;
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
+                (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
+                len = pcapng_get_blocklen(packet);
+                wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len);
+                return len;
+        }
+
+        hdr.blocktype = byteswap32(cur->blocktype);
+        hdr.blocklen = byteswap32(cur->blocklen);
+        hdr.interfaceid = byteswap16(cur->interfaceid);
+        hdr.drops = byteswap16(cur->drops);
+        hdr.timestamp_high = byteswap32(cur->timestamp_high);
+        hdr.timestamp_low = byteswap32(cur->timestamp_low);
+        hdr.caplen = byteswap32(cur->caplen);
+        hdr.wlen = byteswap32(cur->wlen);
+
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
+
+        /* output the packet payload */
+        bodyptr = (char *)packet->buffer + sizeof(hdr);
+        len = pcapng_get_blocklen(packet) - sizeof(hdr) - sizeof(hdr.blocklen);
+        wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, len);
+
+        /* output any options if present */
+        pcapng_output_options(libtrace, packet, bodyptr);
+
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen));
+
+
+        return hdr.blocklen;
+}
+static uint32_t pcapng_output_nameresolution_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+        pcapng_nrb_t *cur = (pcapng_nrb_t *)packet->buffer;
+        pcapng_nrb_t hdr;
+        char *bodyptr = NULL;
+        int padding;
+        void *padding_data;
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
+                (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
+                uint32_t len = pcapng_get_blocklen(packet);
+                wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len);
+                return len;
+        }
+
+        hdr.blocktype = byteswap32(cur->blocktype);
+        hdr.blocklen = byteswap32(cur->blocklen);
+
+        /* output the header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
+        bodyptr = (char *)packet->buffer + sizeof(hdr);
+
+        struct pcapng_nrb_record *nrbr = (struct pcapng_nrb_record *)bodyptr;
+
+        uint16_t record_type = pcapng_get_nrb_record_type(packet, bodyptr);
+        while (record_type != PCAPNG_NRB_RECORD_END) {
+
+                struct pcapng_nrb_record nrb;
+
+                /* recordlen contains only the length of the record value without
+                 * any padding */
+                uint16_t recordlen = pcapng_get_nrb_record_len(packet, bodyptr);
+
+                nrb.recordtype = byteswap16(nrbr->recordtype);
+                nrb.recordlen = byteswap16(nrbr->recordlen);
+
+                /* output the record header */
+                wandio_wwrite(DATAOUT(libtrace)->file, &nrb, sizeof(nrb));
+                bodyptr += sizeof(nrb);
+
+                /* output the record data */
+                wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, recordlen);
+                bodyptr += recordlen;
+
+                /* calculate any required padding. record also contains the 8 byte header
+                 * but we dont need to subtract it because it will be removed with % 4 */
+                padding = recordlen % 4;
+                if (padding) { padding = 4 - padding; }
+                padding_data = calloc(1, padding);
+                /* output the padding */
+                wandio_wwrite(DATAOUT(libtrace)->file, padding_data, padding);
+                free(padding_data);
+                bodyptr += padding;
+
+                /* get the next record if it exists */
+                nrbr = (struct pcapng_nrb_record *)bodyptr;
+                record_type = pcapng_get_nrb_record_type(packet, bodyptr);
+        }
+
+        /* output nrb record end block */
+        struct pcapng_nrb_record nrbftr;
+        nrbftr.recordtype = PCAPNG_NRB_RECORD_END;
+        nrbftr.recordlen = 0;
+        wandio_wwrite(DATAOUT(libtrace)->file, &nrbftr, sizeof(nrbftr));
+        bodyptr += sizeof(nrbftr);
+
+        /* output any options if present */
+        pcapng_output_options(libtrace, packet, bodyptr);
+
+        /* and print out rest of the header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen));
+
+        return hdr.blocklen;
+}
+static uint32_t pcapng_output_custom_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+        pcapng_custom_t *cur = (pcapng_custom_t *)packet->buffer;
+        pcapng_custom_t hdr;
+        char *bodyptr = (char *)packet->buffer;
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
+                (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
+                uint32_t len = pcapng_get_blocklen(packet);
+                wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len);
+                return len;
+        }
+
+        hdr.blocktype = byteswap32(cur->blocktype);
+        hdr.blocklen = byteswap32(cur->blocklen);
+        hdr.pen = byteswap32(cur->blocklen);
+
+        /* output the header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
+        bodyptr += sizeof(hdr);
+
+        /* now print out any options */
+        pcapng_output_options(libtrace, packet, bodyptr);
+
+        /* and print out rest of the header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen));
+
+        return hdr.blocklen;
+}
+static uint32_t pcapng_output_enhanced_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+        pcapng_epkt_t *cur = (pcapng_epkt_t *)packet->buffer;
+        pcapng_epkt_t hdr;
+        char *bodyptr = NULL;
+        uint32_t len;
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
+                (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
+                len = pcapng_get_blocklen(packet);
+                wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len);
+                return len;
+        }
+
+        hdr.blocktype = byteswap32(cur->blocktype);
+        hdr.blocklen = byteswap32(cur->blocklen);
+        hdr.interfaceid = byteswap32(cur->interfaceid);
+        hdr.timestamp_high = byteswap32(cur->timestamp_high);
+        hdr.timestamp_low = byteswap32(cur->timestamp_low);
+        hdr.caplen = byteswap32(cur->caplen);
+        hdr.wlen = byteswap32(cur->wlen);
+
+        /* output beginning of header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
+
+        /* output the packet payload */
+        bodyptr = (char *)packet->buffer + sizeof(hdr);
+        len = pcapng_get_blocklen(packet) - sizeof(hdr) - sizeof(hdr.blocklen);
+        wandio_wwrite(DATAOUT(libtrace)->file, bodyptr, len);
+
+        /* output any options */
+        pcapng_output_options(libtrace, packet, bodyptr);
+
+        /* output end of header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen));
+
+        return hdr.blocklen;
+}
+static uint32_t pcapng_output_interfacestats_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+        pcapng_stats_t *cur = (pcapng_stats_t *)packet->header;
+        pcapng_stats_t hdr;
+        char *bodyptr = NULL;
+
+        /* If the input trace is not pcapng we have no way of finding the byteordering
+         * this can occur if a packet is reconstructed with a deadtrace. Or if the packet
+         * is in the correct byte ordering just output it */
+        if ((packet->trace->format->type != TRACE_FORMAT_PCAPNG) ||
+                (DATA(packet->trace)->byteswapped == DATAOUT(libtrace)->byteswapped)) {
+                uint32_t len = pcapng_get_blocklen(packet);
+                wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer, len);
+                return len;
+        }
+
+        hdr.blocktype = byteswap32(cur->blocktype);
+        hdr.blocklen = byteswap32(cur->blocklen);
+        hdr.interfaceid = byteswap32(cur->interfaceid);
+        hdr.timestamp_high = byteswap32(cur->timestamp_high);
+        hdr.timestamp_low = byteswap32(cur->timestamp_low);
+
+        /* output interface stats header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr, sizeof(hdr));
+        /* output any options if present */
+        bodyptr = (char *)packet->buffer + sizeof(hdr);
+        pcapng_output_options(libtrace, packet, bodyptr);
+        /* output rest of interface stats header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &hdr.blocklen, sizeof(hdr.blocklen));
+
+        return hdr.blocklen;
 }
 
@@ -212 +670 @@
         }
         return 0;
+}
+
+static struct pcapng_timestamp pcapng_get_timestamp(libtrace_packet_t *packet) {
+        struct timeval tv = trace_get_timeval(packet);
+        uint64_t time = ((uint64_t)tv.tv_sec * (uint64_t)1000000) + tv.tv_usec;
+
+        struct pcapng_timestamp timestamp;
+        timestamp.timehigh = time >> 32;
+        timestamp.timelow = time & 0xFFFFFFFF;
+
+        return timestamp;
 }
 
@@ -232 +701 @@
 
         return 0;
+}
+
+static int pcapng_config_output(libtrace_out_t *libtrace, trace_option_output_t option,
+        void *value) {
+
+        switch (option) {
+                case TRACE_OPTION_OUTPUT_COMPRESS:
+                        DATAOUT(libtrace)->compress_level = *(int *)value;
+                        return 0;
+                case TRACE_OPTION_OUTPUT_COMPRESSTYPE:
+                        DATAOUT(libtrace)->compress_type = *(int *)value;
+                        return 0;
+                case TRACE_OPTION_OUTPUT_FILEFLAGS:
+                        DATAOUT(libtrace)->flag = *(int *)value;
+                        return 0;
+                default:
+                        trace_set_err_out(libtrace, TRACE_ERR_UNKNOWN_OPTION,
+                                "Unknown option");
+                        return -1;
+        }
 }
 
@@ -272 +761 @@
 }
 
+static int pcapng_init_output(libtrace_out_t *libtrace) {
+        libtrace->format_data = malloc(sizeof(struct pcapng_format_data_out_t));
+
+        DATAOUT(libtrace)->file = NULL;
+        DATAOUT(libtrace)->compress_level = 0;
+        DATAOUT(libtrace)->compress_type = TRACE_OPTION_COMPRESSTYPE_NONE;
+        DATAOUT(libtrace)->flag = O_CREAT|O_WRONLY;
+
+        DATAOUT(libtrace)->sechdr_count = 0;
+        DATAOUT(libtrace)->byteswapped = false;
+
+        DATAOUT(libtrace)->nextintid = 0;
+        DATAOUT(libtrace)->lastdlt = 0;
+
+        return 0;
+}
+
 static int pcapng_fin_input(libtrace_t *libtrace) {
 
@@ -287 +793 @@
         free(libtrace->format_data);
         return 0;
+}
+
+static int pcapng_fin_output(libtrace_out_t *libtrace) {
+        if (DATAOUT(libtrace)->file) {
+                wandio_wdestroy(DATAOUT(libtrace)->file);
+        }
+        free(libtrace->format_data);
+        libtrace->format_data = NULL;
+        return 0;
 }
 
@@ -432 +947 @@
 }
 
+static int pcapng_write_packet(libtrace_out_t *libtrace, libtrace_packet_t *packet) {
+
+        if (!libtrace) {
+                fprintf(stderr, "NULL trace passed into pcapng_write_packet()\n");
+                return TRACE_ERR_NULL_TRACE;
+        }
+        if (!packet) {
+                trace_set_err_out(libtrace, TRACE_ERR_NULL_PACKET, "NULL packet passed "
+                        "into pcapng_write_packet()\n");
+                return -1;
+        }
+
+        /* Check pcapng can write this type of packet */
+        if (!pcapng_can_write(packet)) {
+                return 0;
+        }
+
+        libtrace_linktype_t linktype = trace_get_link_type(packet);
+
+        /* If the file is not open, open it */
+        if (!DATAOUT(libtrace)->file) {
+                DATAOUT(libtrace)->file = trace_open_file_out(libtrace,
+                        DATAOUT(libtrace)->compress_type,
+                        DATAOUT(libtrace)->compress_level,
+                        DATAOUT(libtrace)->flag);
+        }
+
+        /* If the packet is already encapsulated in a pcapng frame just output it */
+        switch (pcapng_get_record_type(packet)) {
+                case PCAPNG_SECTION_TYPE: {
+                        /* If the section header passed in is byteswapped, everything we output
+                         * till the next section header needs to be byteswapped. The next header
+                         * will determine if we need to continue swapping bytes */
+                        if (DATA(packet->trace)->byteswapped) {
+                                DATAOUT(libtrace)->byteswapped = true;
+                        } else {
+                                DATAOUT(libtrace)->byteswapped = false;
+                        }
+
+                        wandio_wwrite(DATAOUT(libtrace)->file, packet->buffer,
+                                pcapng_get_blocklen(packet));
+
+                        DATAOUT(libtrace)->sechdr_count += 1;
+
+                        return pcapng_get_blocklen(packet);
+                }
+                case PCAPNG_INTERFACE_TYPE: {
+                        /* increment the interface id */
+                        DATAOUT(libtrace)->nextintid += 1;
+
+                        return pcapng_output_interface_packet(libtrace, packet);
+                }
+                case PCAPNG_OLD_PACKET_TYPE: {
+                        return pcapng_output_old_packet(libtrace, packet);
+                }
+                case PCAPNG_SIMPLE_PACKET_TYPE: {
+                        if (DATAOUT(libtrace)->nextintid == 0) {
+                                trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET,
+                                        "Cannot output simple packet before a interface "
+                                        "block has been output in pcapng_write_packet()\n");
+                                return -1;
+                        }
+                        return pcapng_output_simple_packet(libtrace, packet);
+                }
+                case PCAPNG_NAME_RESOLUTION_TYPE: {
+                        return pcapng_output_nameresolution_packet(libtrace, packet);
+                }
+                case PCAPNG_INTERFACE_STATS_TYPE: {
+                        if (DATAOUT(libtrace)->nextintid == 0) {
+                                trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET,
+                                        "Cannot output a interface statistics block before a "
+                                        "interface block has been output in pcapng_write_packet()\n");
+                                return -1;
+                        }
+                        return pcapng_output_interfacestats_packet(libtrace, packet);
+                }
+                case PCAPNG_ENHANCED_PACKET_TYPE: {
+                        if (DATAOUT(libtrace)->nextintid == 0) {
+                                trace_set_err_out(libtrace, TRACE_ERR_BAD_PACKET,
+                                        "Cannot output enhanced packet before a interface "
+                                        "block has been output in pcapng_write_packet()\n");
+                                return -1;
+                        }
+                        return pcapng_output_enhanced_packet(libtrace, packet);
+                }
+                case PCAPNG_CUSTOM_TYPE: {
+                        return pcapng_output_custom_packet(libtrace, packet);
+                }
+                case PCAPNG_DECRYPTION_SECRETS_TYPE: {
+                        return 0;
+                }
+                case PCAPNG_CUSTOM_NONCOPY_TYPE: {
+                        /* This custom block type is not ment to be copied */
+                        return 0;
+                }
+                default: {
+
+                        /* create section header if not already */
+                        if (DATAOUT(libtrace)->sechdr_count == 0) {
+                                /* Create section block */
+                                pcapng_sec_t sechdr;
+                                sechdr.blocktype = pcapng_swap32(libtrace, PCAPNG_SECTION_TYPE);
+                                sechdr.blocklen = pcapng_swap32(libtrace, 28);
+                                sechdr.ordering = pcapng_swap32(libtrace, 0x1A2B3C4D);
+                                sechdr.majorversion = pcapng_swap16(libtrace, 1);
+                                sechdr.minorversion = 0;
+                                sechdr.sectionlen = 0xFFFFFFFFFFFFFFFF;
+
+                                wandio_wwrite(DATAOUT(libtrace)->file, &sechdr, sizeof(sechdr));
+                                wandio_wwrite(DATAOUT(libtrace)->file, &sechdr.blocklen, sizeof(sechdr.blocklen));
+
+                                DATAOUT(libtrace)->sechdr_count += 1;
+                        }
+
+                        /* create interface header if not already or if the linktype has changed */
+                        if (DATAOUT(libtrace)->nextintid == 0
+                                || DATAOUT(libtrace)->lastdlt != linktype) {
+                                /* Create interface block*/
+                                pcapng_int_t inthdr;
+                                inthdr.blocktype = pcapng_swap32(libtrace, PCAPNG_INTERFACE_TYPE);
+                                inthdr.blocklen = pcapng_swap32(libtrace, 20);
+                                inthdr.linktype = pcapng_swap16(libtrace, libtrace_to_pcap_dlt(linktype));
+                                inthdr.reserved = 0;
+                                inthdr.snaplen = 0;
+
+                                wandio_wwrite(DATAOUT(libtrace)->file, &inthdr, sizeof(inthdr));
+                                wandio_wwrite(DATAOUT(libtrace)->file, &inthdr.blocklen, sizeof(inthdr.blocklen));
+
+                                /* increment the interface counter */
+                                DATAOUT(libtrace)->nextintid += 1;
+                                /* update the last linktype */
+                                DATAOUT(libtrace)->lastdlt = linktype;
+                        }
+
+                        break;
+                }
+        }
+
+        /* If we get this far the packet is not a pcapng type so we need to encapsulate it
+         * within a enhanced pcapng packet */
+        uint32_t remaining;
+        void *link;
+        uint32_t blocklen;
+        uint32_t padding;
+        uint32_t caplen;
+        uint32_t wirelen;
+        void *padding_data;
+        pcapng_epkt_t epkthdr;
+
+        link = trace_get_packet_buffer(packet, &linktype, &remaining);
+
+        wirelen = trace_get_wire_length(packet);
+        caplen = trace_get_capture_length(packet);
+
+        /* trace_get_wirelength includes FCS, while pcapng doesn't */
+        if (trace_get_link_type(packet)==TRACE_TYPE_ETH) {
+                if (wirelen >= 4) {
+                        wirelen -= 4;
+                } else {
+                        wirelen = 0;
+                }
+        }
+        /* capture length should always be less than the wirelength */
+        if (caplen > wirelen) {
+                caplen = wirelen;
+        }
+
+        /* calculate padding to 32bits */
+        padding = caplen % 4;
+        if (padding) { padding = 4 - padding; }
+        padding_data = calloc(1, padding);
+
+        /* get pcapng_timestamp */
+        struct pcapng_timestamp ts = pcapng_get_timestamp(packet);
+
+        /* calculate the block length */
+        blocklen = sizeof(epkthdr) + sizeof(epkthdr.blocklen) + caplen + padding;
+
+        /* construct the packet */
+        epkthdr.blocktype = pcapng_swap32(libtrace, PCAPNG_ENHANCED_PACKET_TYPE);
+        epkthdr.blocklen = pcapng_swap32(libtrace, blocklen);
+        epkthdr.interfaceid = pcapng_swap32(libtrace, DATAOUT(libtrace)->nextintid-1);
+        epkthdr.timestamp_high = pcapng_swap32(libtrace, ts.timehigh);
+        epkthdr.timestamp_low = pcapng_swap32(libtrace, ts.timelow);
+        epkthdr.wlen = pcapng_swap32(libtrace, wirelen);
+        epkthdr.caplen = pcapng_swap32(libtrace, caplen);
+
+        /* output enhanced packet header */
+        wandio_wwrite(DATAOUT(libtrace)->file, &epkthdr, sizeof(epkthdr));
+        /* output the packet */
+        wandio_wwrite(DATAOUT(libtrace)->file, link, (size_t)caplen);
+        /* output padding */
+        wandio_wwrite(DATAOUT(libtrace)->file, padding_data, (size_t)padding);
+        /* output rest of the enhanced packet */
+        wandio_wwrite(DATAOUT(libtrace)->file, &epkthdr.blocklen, sizeof(epkthdr.blocklen));
+
+        /* release padding memory */
+        free(padding_data);
+
+        return blocklen;
+}
+
+static int pcapng_flush_output(libtrace_out_t *libtrace) {
+        return wandio_wflush(DATAOUT(libtrace)->file);
+}
+
 static int pcapng_read_section(libtrace_t *libtrace,
                 libtrace_packet_t *packet, uint32_t flags) {
@@ -437 +1158 @@
         pcapng_sec_t *sechdr;
         int err;
-        uint32_t to_read;
+        uint32_t to_read, blocklen;
         char *bodyptr = NULL;
 
@@ -481 +1202 @@
                         return -1;
                 }
-                to_read = byteswap32(sechdr->blocklen) - sizeof(pcapng_sec_t);
+                blocklen = byteswap32(sechdr->blocklen);
+
         } else {
                 if (sechdr->majorversion != 1 && sechdr->minorversion != 0) {
@@ -488 +1210 @@
                         return -1;
                 }
-                to_read = sechdr->blocklen - sizeof(pcapng_sec_t);
-        }
-
+                blocklen = sechdr->blocklen;
+        }
+
+        if (blocklen < sizeof(pcapng_sec_t)) {
+                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET,
+                                "Block length in pcapng section header is invalid.");
+                return -1;
+        }
+        to_read = blocklen - sizeof(pcapng_sec_t);
         /* Read all of the options etc. -- we don't need them for now, but
          * we have to skip forward to the next useful header. */
         bodyptr = (char *) packet->buffer + sizeof(pcapng_sec_t);
+
+        if (to_read > LIBTRACE_PACKET_BUFSIZE) {
+                trace_set_err(libtrace, TRACE_ERR_BAD_PACKET,
+                                "Excessively large section header contents of %u bytes, likely a corrupt trace.", to_read);
+                return -1;
+        }
+
         err = pcapng_read_body(libtrace, bodyptr, to_read);
         if (err <= 0) {
@@ -1092 +1827 @@
 }
 
-static libtrace_linktype_t pcapng_get_link_type(const libtrace_packet_t *packet)
-{
+static libtrace_linktype_t pcapng_get_link_type(const libtrace_packet_t *packet) {
+
+        if (packet->type == TRACE_RT_PCAPNG_META) {
+                return TRACE_TYPE_PCAPNG_META;
+        }
 
         return pcap_linktype_to_libtrace(rt_to_pcap_linktype(packet->type));
-
 }
 
@@ -1112 +1849 @@
         uint32_t interfaceid = 0;
         pcapng_interface_t *interface;
+
+        memset(&ts, 0, sizeof(struct timespec));
 
         if (!packet) {
@@ -1436 +2175 @@
         pcapng_start_input,             /* start_input */
         NULL,                           /* pause_input */
-        NULL,                           /* init_output */
-        NULL,                           /* config_output */
+        pcapng_init_output,             /* init_output */
+        pcapng_config_output,           /* config_output */
         NULL,                           /* start_output */
         pcapng_fin_input,               /* fin_input */
-        NULL,                           /* fin_output */
+        pcapng_fin_output,              /* fin_output */
         pcapng_read_packet,             /* read_packet */
         pcapng_prepare_packet,          /* prepare_packet */
         NULL,                           /* fin_packet */
-        NULL,                           /* write_packet */
-        NULL,                           /* flush_output */
+        pcapng_write_packet,            /* write_packet */
+        pcapng_flush_output,            /* flush_output */
         pcapng_get_link_type,           /* get_link_type */
         pcapng_get_direction,           /* get_direction */
@@ -1474 +2213 @@
         register_format(&pcapng);
 }
-

lib/libtrace.h.in

@@ -414 +414 @@
        TRACE_TYPE_OPENBSD_LOOP = 20,    /**< OpenBSD loopback */
        TRACE_TYPE_ERF_META = 21, /**< ERF Provenance metadata record */
-       TRACE_TYPE_ETSILI = 22   /**< ETSI Lawful Intercept */
+       TRACE_TYPE_ETSILI = 22,  /**< ETSI Lawful Intercept */
+       TRACE_TYPE_PCAPNG_META = 23,     /** PCAPNG meta packet */
 } libtrace_linktype_t;
 

lib/linktypes.c

@@ -110 +110 @@
                 case TRACE_TYPE_ETSILI:
                         break;
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_UNKNOWN:
                 case TRACE_TYPE_CONTENT_INVALID:
@@ -212 +213 @@
                 case TRACE_TYPE_OPENBSD_LOOP:
                 case TRACE_TYPE_ETSILI:
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_UNKNOWN:
                 case TRACE_TYPE_CONTENT_INVALID:

lib/protocols.h

@@ -24 +24 @@
  *
  */
+
+#ifndef LIBTRACE_PROTOCOLS_H_
+#define LIBTRACE_PROTOCOLS_H_
 
 /** @file
@@ -81 +84 @@
 };
 
-
+#endif

lib/protocols_l2.c

@@ -690 +690 @@
          * calling trace_get_packet_buffer more than once like we used to.
          */
-        
         meta = trace_get_packet_buffer(packet, linktype, remaining);
+        if (meta == NULL) {
+                return NULL;
+        }
 
         /* If there are no meta-data headers, we just return the start of the
@@ -719 +721 @@
                 case TRACE_TYPE_PFLOG:
                 case TRACE_TYPE_ERF_META:
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_ETSILI:
                         break;
@@ -757 +760 @@
                                 case TRACE_TYPE_PFLOG:
                                 case TRACE_TYPE_ERF_META:
+                                case TRACE_TYPE_PCAPNG_META:
                                 case TRACE_TYPE_ETSILI:
                                         break;
@@ -808 +812 @@
                 return NULL;
         }
-        
+
+        if (link == NULL) {
+                return NULL;
+        }
+
         switch(linktype) {
                 /* Packet Metadata headers, not layer2 headers */
@@ -827 +835 @@
                 case TRACE_TYPE_METADATA:
                 case TRACE_TYPE_NONDATA:
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_ERF_META:
                 case TRACE_TYPE_CONTENT_INVALID:
@@ -837 +846 @@
                         return trace_get_payload_from_ethernet(link,ethertype,remaining);
                 case TRACE_TYPE_NONE:
+                        if (*remaining == 0) {
+                                return NULL;
+                        }
+
                         if ((*(char*)link&0xF0) == 0x40)
                                 *ethertype=TRACE_ETHERTYPE_IP;   /* IPv4 */
                         else if ((*(char*)link&0xF0) == 0x60)
                                 *ethertype=TRACE_ETHERTYPE_IPV6; /* IPv6 */
+                        else
+                                return NULL;            /* No idea */
                         return link; /* I love the simplicity */
                 case TRACE_TYPE_PPP:
@@ -865 +880 @@
 
                 case TRACE_TYPE_OPENBSD_LOOP:
+                        if (*remaining <= 4) {
+                                return NULL;
+                        }
                         link = link + 4; /* Loopback header is 4 bytes */
                         if ((*(char*)link&0xF0) == 0x40)
@@ -870 +888 @@
                         else if ((*(char*)link&0xF0) == 0x60)
                                 *ethertype=TRACE_ETHERTYPE_IPV6; /* IPv6 */
+                        else
+                                return NULL;
                         return link; /* I love the simplicity */
                 
@@ -937 +957 @@
                 case TRACE_TYPE_OPENBSD_LOOP:
                 case TRACE_TYPE_ERF_META:
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_UNKNOWN:
                 case TRACE_TYPE_CONTENT_INVALID:
@@ -993 +1014 @@
                 case TRACE_TYPE_OPENBSD_LOOP:
                 case TRACE_TYPE_ERF_META:
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_UNKNOWN:
                 case TRACE_TYPE_CONTENT_INVALID:

lib/protocols_pktmeta.c

@@ -191 +191 @@
                 case TRACE_TYPE_OPENBSD_LOOP:
                 case TRACE_TYPE_UNKNOWN:
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_CONTENT_INVALID:
                         return NULL;
@@ -249 +250 @@
                         return nexthdr;
 
+                case TRACE_TYPE_PCAPNG_META:
                 case TRACE_TYPE_HDLC_POS:
                 case TRACE_TYPE_ETH:

lib/trace.c

@@ -1431 +1431 @@
 DLLEXPORT size_t trace_get_wire_length(const libtrace_packet_t *packet){
 
+        size_t wiresub = 0;
+
         if (packet->which_trace_start != packet->trace->startcount) {
                 return ~0U;
@@ -1442 +1444 @@
         }
 
-        if (!(packet->cached.wire_length < LIBTRACE_PACKET_BUFSIZE)) {
-                fprintf(stderr, "Wire length is greater than the buffer size in trace_get_wire_length()\n");
-                return 0;
+        if (packet->type >= TRACE_RT_DATA_DLT && packet->type <=
+                        TRACE_RT_DATA_DLT_END) {
+
+                /* pcap wire lengths in libtrace include an extra four bytes
+                 * for the FCS (to be consistent with other formats that do
+                 * capture the FCS), but these bytes don't actually exist on
+                 * the wire. Therefore, we shouldn't get upset if our "wire"
+                 * length exceeds the max buffer size by four bytes or less.
+                 */
+                if (packet->cached.wire_length >= 4) {
+                        wiresub = 4;
+                } else {
+                        wiresub = packet->cached.wire_length;
+                }
+        } else {
+                wiresub = 0;
+        }
+
+        if (!(packet->cached.wire_length - wiresub < LIBTRACE_PACKET_BUFSIZE)) {
+                fprintf(stderr, "Wire length %zu exceeds expected maximum packet size of %d -- packet is likely corrupt.\n",
+                                packet->cached.wire_length - wiresub,
+                                LIBTRACE_PACKET_BUFSIZE);
+
                 /* should we be returning ~OU here? */
         }
@@ -1554 +1576 @@
 #else
         struct libtrace_filter_t *filter = (struct libtrace_filter_t *)
-                malloc(sizeof(struct libtrace_filter_t));
+                calloc(1, sizeof(struct libtrace_filter_t));
         filter->filter.bf_insns = (struct bpf_insn *)
                 malloc(sizeof(struct bpf_insn) * bf_len);
@@ -1578 +1600 @@
 #ifdef HAVE_BPF
         libtrace_filter_t *filter = (libtrace_filter_t*)
-                                malloc(sizeof(libtrace_filter_t));
+                                calloc(1, sizeof(libtrace_filter_t));
         filter->filterstring = strdup(filterstring);
         filter->jitfilter = NULL;
@@ -1718 +1740 @@
         linktype = trace_get_link_type(packet);
 
-        if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_ERF_META)
+        if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_ERF_META
+                || linktype == TRACE_TYPE_PCAPNG_META)
                 return 1;
 

lib/trace_parallel.c

@@ -2277 +2277 @@
 
         if (ret == -1) {
+                libtrace_err_t err UNUSED;
+
                 /* We have to deal with this ourself */
+                /* If we succeed, clear any error state otherwise our caller
+                 * might assume an error occurred, even though we've resolved
+                 * the issue ourselves.
+                 */
                 if (!hasher) {
                         switch (type)
@@ -2283 +2289 @@
                                 case HASHER_CUSTOM:
                                 case HASHER_BALANCE:
+                                        err = trace_get_err(trace);
                                         return 0;
                                 case HASHER_BIDIRECTIONAL:
@@ -2288 +2295 @@
                                         trace->hasher_data = calloc(1, sizeof(toeplitz_conf_t));
                                         toeplitz_init_config(trace->hasher_data, 1);
+                                        err = trace_get_err(trace);
                                         return 0;
                                 case HASHER_UNIDIRECTIONAL:
@@ -2293 +2301 @@
                                         trace->hasher_data = calloc(1, sizeof(toeplitz_conf_t));
                                         toeplitz_init_config(trace->hasher_data, 0);
+                                        err = trace_get_err(trace);
                                         return 0;
                         }